Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1mJkPq-00025A-98
	for pgsql-hackers@arkaria.postgresql.org; Fri, 27 Aug 2021 22:33:38 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1mJkPp-0001kO-A5
	for pgsql-hackers@arkaria.postgresql.org; Fri, 27 Aug 2021 22:33:37 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <sfrost@tamriel.snowman.net>)
	id 1mJkPp-0001kF-24
	for pgsql-hackers@lists.postgresql.org; Fri, 27 Aug 2021 22:33:37 +0000
Received: from tamriel.snowman.net ([70.109.60.50])
	by magus.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <sfrost@tamriel.snowman.net>)
	id 1mJkPm-0005Sd-TX
	for pgsql-hackers@lists.postgresql.org; Fri, 27 Aug 2021 22:33:36 +0000
Received: by tamriel.snowman.net (Postfix, from userid 1000)
	id 5FE565F799; Fri, 27 Aug 2021 18:33:33 -0400 (EDT)
Date: Fri, 27 Aug 2021 18:33:33 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Michael Banck <michael.banck@credativ.de>
Cc: gkokolatos@pm.me, Anastasia Lubennikova <a.lubennikova@postgrespro.ru>,
	"pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>
Subject: Re: New predefined roles- 'pg_read/write_all_data'
Message-ID: <20210827223333.GW17906@tamriel.snowman.net>
References: <20200828003023.GU29590@tamriel.snowman.net>
 <159895771273.18329.10477215354702372718.pgcf@coridan.postgresql.org>
 <160397087449.1204.5186411958611164965.pgcf@coridan.postgresql.org>
 <20201029141959.GK16415@tamriel.snowman.net>
 <5a3e197e-3f6c-50e4-9774-c6b82b7151f1@postgrespro.ru>
 <20201123223147.GQ16415@tamriel.snowman.net>
 <4GHYHFHb6AQyOjxMZ47he7YvJSBAkZr968U31kr8a2GLlNFyXRH_-DJAjcL2Xh6jJ3TumkX44XkoeG3Utj5u8UA4thBUt9m87tv8WIDNoCg=@pm.me>
 <20210401200006.GV20766@tamriel.snowman.net>
 <606d8b1c.1c69fb81.3df04.1a99@mx.google.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="wEUdGI42XAwEDC/y"
Content-Disposition: inline
In-Reply-To: <606d8b1c.1c69fb81.3df04.1a99@mx.google.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Archived-At: 
 <https://www.postgresql.org/message-id/20210827223333.GW17906%40tamriel.snowman.net>
Precedence: bulk


--wEUdGI42XAwEDC/y
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Michael Banck (michael.banck@credativ.de) wrote:
> On Thu, Apr 01, 2021 at 04:00:06PM -0400, Stephen Frost wrote:
> > diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml
> > index d171b13236..fe0bdb7599 100644
> > --- a/doc/src/sgml/user-manag.sgml
> > +++ b/doc/src/sgml/user-manag.sgml
> > @@ -518,6 +518,24 @@ DROP ROLE doomed_role;
> >        </row>
> >       </thead>
> >       <tbody>
> > +      <row>
> > +       <entry>pg_read_all_data</entry>
> > +       <entry>Read all data (tables, views, sequences), as if having S=
ELECT
> > +       rights on those objects, and USAGE rights on all schemas, even =
without
> > +       having it explicitly.  This role does not have the role attribu=
te
> > +       <literal>BYPASSRLS</literal> set.  If RLS is being used, an adm=
inistrator
> > +       may wish to set <literal>BYPASSRLS</literal> on roles which thi=
s role is
> > +       GRANTed to.</entry>
> > +      </row>
> > +      <row>
> > +       <entry>pg_write_all_data</entry>
> > +       <entry>Write all data (tables, views, sequences), as if having =
INSERT,
> > +       UPDATE, and DELETE rights on those objects, and USAGE rights on=
 all
> > +       schemas, even without having it explicitly.  This role does not=
 have the
> > +       role attribute <literal>BYPASSRLS</literal> set.  If RLS is bei=
ng used,
> > +       an administrator may wish to set <literal>BYPASSRLS</literal> o=
n roles
> > +       which this role is GRANTed to.</entry>
> > +      </row>
>=20
> Shouldn't those "SELECT", "INSERT" etc. be wrapped in <command> tags?

Yeah, good point, fixed.

Thanks!

Stephen

--wEUdGI42XAwEDC/y
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJhKWg8AAoJEO1sijiDR2RVc54QAMct1fm+d0wutE8zALeH5MAp
OTxon4UkosAAqY14mCgI4EDDjRpmHCzsmd3xhqw3wTIAuSNiMDZnOgSSzDElYLV4
vRTz48XrQZLMnD/28jPmnBWjJIf9lTXsSYzCJB5oJ7RSfxu3rIHGmOjmy42CMGap
Lw4y7hqrOQwnSTitihFTB6RefDrsBUgWDT4YZiGIRpkLQtmv1QIS4KAPPPjQgjgb
TySPJXffOdmErI5JkL5VJ97mcUKXhazl+JjAgq01Q5gEJw+k487KI3IeKsUSRTGD
nWkvOCDiTH8TBR3OuqJwJlw0oDpiKR4ByP8G++uI/cy2aJoBWG7gvVeivWe/6dyo
1DmaE/Ina9JhHUMHOb2LLa5WNJRH9oskM4NgMVFxXENqVTpkglD3qp4yVzE1axP5
B5wriFt9233hr+PHQddsILAfQkyRPIj2CiITwXWlIiPEmKw0+m9R9+NrnUO4inaS
gKiG0Ncze7fbpM4YZYcuKCfO8guU0yH5tF8YX/8f/4IkJgbIBc2g67+9mvoccSgA
JLshA/mforTIjsnmEplHbdZDVsPdf2aC9jX6gMz5PzrypIeyR7XxrDsYR/RiHVVA
d36IuZGZyTQ8bIEAKFAfIHQrV56b3IbYAoGW7pfX5mTkaD2nKdUr2fVnYURwiBwW
VssghirRyBCmN1ADqwOI
=KsO5
-----END PGP SIGNATURE-----

--wEUdGI42XAwEDC/y--